You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Apr 2, 2024. It is now read-only.
Copy file name to clipboardExpand all lines: docs/source/config/decoders/geoip_decoder.rst
+30-11Lines changed: 30 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,25 +3,45 @@ GeoIpDecoder
3
3
4
4
.. versionadded:: 0.6
5
5
6
-
Decoder plugin that generates GeoIP data based on the IP address of a specified field. It uses the Go project: https://github.com/abh/geoip as a wrapper around MaxMind's geoip-api-c library.
7
-
This decoder assumes you have downloaded and installed the `geoip-api-c <https://github.com/maxmind/geoip-api-c/releases/>`_ library from MaxMind's website.
8
-
Currently, only the GeoLiteCity database is supported, which you must also download and install yourself into a location to be referenced by the db_file config option.
9
-
By default the database file is opened using "GEOIP_MEMORY_CACHE" mode. This setting is hard-coded into the wrapper's geoip.go file. You will need to manually override that code
10
-
if you want to specify one of the other modes listed `here: <https://github.com/maxmind/geoip-api-c/blob/master/README.md#memory-caching-and-other-options/>`_
6
+
Decoder plugin that generates GeoIP data based on the IP address of a
7
+
specified field. It uses the `GeoIP Go project
8
+
<https://github.com/abh/geoip>`_ as a wrapper around MaxMind's `geoip-api-c
9
+
library <https://github.com/maxmind/geoip-api-c/releases/>`_, and thus assumes
10
+
you have the library downloaded and installed. Currently, only the GeoLiteCity
11
+
database is supported, which you must also download and install yourself into
12
+
a location to be referenced by the db_file config option. By default the
13
+
database file is opened using "GEOIP_MEMORY_CACHE" mode. This setting is hard-
14
+
coded into the wrapper's geoip.go file. You will need to manually override
15
+
that code if you want to specify one of the other modes listed `here
If you are using this with the ES output you will likely need to specify the raw_bytes_field option for the target_field specified. This is required to preserve the formatting of the JSON object.
20
+
Due to external dependencies, this plugin is not compiled in to the
21
+
released Heka binaries. It will automatically be included in a
22
+
:ref:`source build <from_source>` if GeoIP.h is available in the include
23
+
path during build time. The generated binary will then only work on
24
+
machines with the appropriate GeoIP shared library (e.g. `libGeoIP.so.1`)
25
+
installed.
26
+
27
+
.. note::
28
+
If you are using this with the ES output you will likely need to specify
29
+
the raw_bytes_field option for the target_field specified. This is
30
+
required to preserve the formatting of the JSON object.
14
31
15
32
Config:
16
33
17
34
- db_file:
18
-
The location of the GeoLiteCity.dat database. Defaults to "/var/cache/hekad/GeoLiteCity.dat"
35
+
The location of the GeoLiteCity.dat database. Defaults to
36
+
"/var/cache/hekad/GeoLiteCity.dat"
19
37
20
38
- source_ip_field:
21
-
The name of the field containing the IP address you want to derive the location for.
39
+
The name of the field containing the IP address you want to derive the
40
+
location for.
22
41
23
-
- target_field:
24
-
The name of the new field created by the decoder. The decoder will output a JSON object with the following elements:
42
+
- target_field:
43
+
The name of the new field created by the decoder. The decoder will output
0 commit comments